12 Steps to Cloning Windows NT Systems with SYSDIFF.EXE

When you acquire new systems for your organization, you face the challenging task of installing Windows NT, applications, and data on them. Swapping floppy disks and CD-ROMs, entering information, changing defaults, and performing the other required tasks to get an NT system up and running just takes too much time, particularly when you have to do it for several systems at once.

For example, say you need to set up 15 systems for new employees, each system with the same hardware, running NT 4.0, and including 10 applications. In addition, you must make the necessary changes to the Registry on each system for the Explorer interface and security. Setting up the systems manually is costly in time and productivity. Letting users install NT and applications for you wastes their productive time and leads to installation errors. Cloning is the answer.

Approaching Cloning
The goal of cloning is to create a duplicate system with all the original system's interface changes, tweaks, installed software, and options. However, each system you clone must be a unique system on the network. Merely copying all the files with XCOPY.EXE won't work because a copied system has the same security identifiers (SIDs) as the original for the operating system, machine name, and shares. The problem with such copying is that to ensure connectivity with servers, each cloned system must have unique SIDs, especially the machine name. Also, the cloning process must be fast; if not, it isn't worth the effort. And you need to be able to clone NT systems without incurring extra costs for necessities such as software and licensing.

To meet these requirements, the best approach to cloning is to take a currently set-up system, make sure it has the applications, data, and settings you want, and duplicate that machine's setup (except for the SIDs) on other systems. One cloning method is to use Computer Profile Setup (CPS), a set of utilities in the Windows NT 3.51 Resource Kit that lets you create a master system configuration that you can copy to other machines. However, CPS is difficult to use and doesn't always create unique SIDs. Third-party cloning products, such as Ghost from Binary Software and DriveCopy from PowerQuest are alternatives. Such products work well for cloning Windows 3.x and Windows 95 systems. However, for NT cloning, these products have some limitations. For example, these products can't deal with NT's requirement for unique computer names and IP addresses, nor can they handle differences in hardware, drivers, and settings. An easier, more reliable method is SYSDIFF.EXE, a tool on the Windows NT Server 4.0 CD-ROM (documentation for SYSDIFF.EXE is in the NT 4.0 Resource Kit).

The SYSDIFF.EXE utility lets you clone system modifications, applications, and changes--but not the NT operating system. You must install NT on the systems before using SYSDIFF.EXE for cloning; I explain a method for combining the NT installation and cloning process later. SYSDIFF.EXE can help make the necessary interface changes and connections to the network and shares. It can also help install application files and implement the necessary Registry changes associated with those files.

You can use SYSDIFF.EXE to perform these tasks in two ways, both of which I explain in this article. You can combine Registry changes and the binary files required to run the applications, putting them into a difference file (a file that identifies differences between the original and current configurations of the system being cloned) and then copy the difference file to the new system. Alternatively, you can use SYSDIFF.EXE to make only Registry changes. This approach creates an .INF file. You then copy the files by performing a backup and restore or by recording the files on a CD-recordable drive and copying them to the target system. Whether or not you include all the programs and auxiliary files, when you decide to clone your system, the most important part of the operation is the Registry.

SYSDIFF.EXE Prerequisites
For SYSDIFF.EXE to work correctly, several things are necessary, including

  • a master system with NT Server or Workstation 4.0 installed. You will make necessary changes on and add applications to this system.
  • a share on the server for the SYSDIFF.EXE application and auxiliary files, with sufficient space for all the applications to be installed on the master system. In this article, this share is in D:\BIN, shared as \\SERVER1\SOURCE.
  • SYSDIFF.EXE, which creates and applies the necessary files for cloning. It is on the NT 4.0 Server CD-ROM in the SUPPORT\DEPTOOLS\platform directory. Copy it to the share you've reserved on the server.
  • the snapshot file, which SYSDIFF.EXE creates to record the current system status (i.e., create the before picture).
  • SYSDIFF.INF, which controls what SYSDIFF.EXE looks for when it creates its snapshot and difference files. Copy this file from the CD-ROM to the share.
  • the difference file (i.e., the after picture), which SYSDIFF.EXE creates and which includes the changes made to the Registry, application files, and files associated with them.
  • the target systems, which already have NT installed. You'll copy the changes in the difference file to these systems.

If any of these parts are missing, preparing and implementing the clone installations will not work.

Step-by-Step Cloning: The Difference File Method
Here are 12 steps for cloning NT systems, using SYSDIFF.EXE to create a difference file that you'll copy to the target system.

  1. Install NT Workstation or Server 4.0 on the master system. However, wait to install applications until step 5.
  2. At the master system, map a drive letter to a share on the server (for example, X:\ is mapped to D:\BIN).
    1. At the server, copy the SYSDIFF.EXE and SYSDIFF.INF files from the NT 4.0 Server CD-ROM in the SUPPORT\DEPTOOLS\PLATFORM directory to D:\BIN.

      Tip: Run the SYSDIFF.EXE application from the server's shared directory. Store the snapshot and difference files in this directory, as well. You might get slightly better performance by running SYSDIFF.EXE from your local drive, but doing so requires more manual copying of files.

      Warning: Putting the difference file on your local drive on the master system might cause SYSDIFF.EXE to create a monstrous file or even hang the process. The system might get caught in a loop, trying to copy the file it is copying to. To improve performance by using your local drive for storing the difference file, add the path in which the difference file will be stored to the SYSDIFF.INF file under the \[ExcludeDirectoryTrees\] section. Then, SYSDIFF.EXE will ignore and exclude the difference file from the snapshot and difference file process.

    2. At the master system, run the command

      SYSDIFF /SNAP X:\before.img

      (you can use any 32-bit valid filename). This command takes a snapshot of the current NT installation and of all installed files and settings. The snapshot includes the directories and files, Registry, and .INI files. Figure 1 shows the SYSDIFF.EXE procedure in process. When finished with the process, SYSDIFF notifies you with a "Snapshot complete" message in a dialog box. (You can use the procedures listed here to add software to an installed system. When you run the snapshot, it takes a current picture. From that point, adding other items produces a difference file.)

    3. Set up NT on the master system the way you want, including (but not limited to) shares, printers, and network connections.
    4. Make Registry changes on the master system by editing the Registry directly or through the Control Panel. (For more information about editing the Registry, see Christa Anderson, "Care and Feeding of the Registry," December 1996.)
    5. Add software applications to the master system.
    6. Set up applications as you want, including default directories, toolbars, preferences, and other settings.

      Warning: Before performing the next step to create the difference file, reboot the master system to ensure all functions relating to the application installation are completed and all files have been closed.

    7. Run the command

      SYSDIFF /DIFF X:\before.img X:\after.img

      at the master system, with X:\before.img being the snapshot file and path and X:\after.img being the difference file and path. (You can give the difference file any extension you want; I usually don't give it an extension, because of the difficulty in using the command line and the decimal place.) SYSDIFF.EXE takes a snapshot of the entire system again, compares the new snapshot to the old one as shown in Screen 1, and writes the difference file to the hard disk.

      The difference file includes all changes, directories, and files and can be an extremely large file. The difference file includes the directories and files (as you see in Screen 2), Registry changes (Screen 3 shows these changes), and .INI files (which are in Screen 4). Once the difference file has been written to disk, a dialog box appears with a "Diff complete" message.

    8. Install NT on the target system.

      Warning: All systems receiving the difference file must have NT in a directory that has the same name on each system.

    9. On the target system, map a drive letter to the snapshot/difference file location, such as X:\ mapped to the server's D:\BIN.
    10. Use


      (X:\after.img is the difference file and path) to apply the difference file to the target system. SYSDIFF.EXE copies all the binary files to the target system and then makes the necessary changes to the Registry and .INI files. The benefit of using SYSDIFF.EXE is that you don't need to use the application setup functions to install the applications.

      As soon as you get one system started in the cloning process, you can start another. NT networking lets multiple systems access the same file. The only limitation to having multiple systems access the server is the amount of traffic each system generates.

      Tip: At this point, you can simultaneously apply the difference file to as many NT systems as you can connect to the network. However, first test the process on one system to ensure that the procedure works exactly as planned. Then, attach to the network and clone away.

    When cloning, you might encounter error messages. "Possible Error Messages ," lists some errors I've found and fixes for them.

    Combining NT Installation and Cloning
    A great shortcut to improve cloning performance is to combine the installation and cloning processes into one command. You can take advantage of a trick similar to one hardware manufacturers use: SETUPMGR.EXE lets you create an answer file (i.e., a text-file NT installation script) that performs an unattended installation. (For more information about using an answer file and SETUPMGR.EXE to perform an unattended installation, see Christa Anderson, "Designing Unattended NT Installations," March 1997.)

    During the NT installation, NT automatically copies all directories and files that are in a directory called $OEM$, if it's directly under the NT installation files (usually \I386 on the NT CD-ROM, but copied to D:\BINof the server in this example). SYSDIFF.EXE and its options automatically create that directory for you, including all the necessary files. NT then installs the files on the target system and makes the necessary Registry and .INI file changes, too.

    To use this alternative procedure, perform steps 1 through 11 to create the difference file. Then you must prepare the target system for file installation. Finally, you create the .INF file by selecting the NT Start menu, Run, and then entering the following:

    D:\Bin\SYSDIFF.EXE /inf d:\bin\after.img d:\bin2

    D:\bin\after.img is the path and name of the difference file, and d:\bin2 is the location for the .INF file and changes to the system.

    The .INF file is given the same name as the difference file, except that the .INF file has an INF extension (in this case, AFTER.INF). Screen 5 shows the contents of the .INF file; you can display the file in Notepad or in any other text editor or word processor.

    With the setup information you supply to SETUPMGR.EXE and the $OEM$ directory you created with the /INF option and SYSDIFF.EXE, you have the necessary files to perform a complete installation with NT, services, applications, Registry settings, and all preferences set. After you boot the target system and connect it to the server, start the NT installation. If you named the answer file UNATTENDED.TXT in D:\BIN, the command line you use is


    Notice you do not need to specify the $OEM$ directory or add anything to get the system to install the applications. Installation occurs as a function of the installation, with no added input on your part. Once the installation is complete, NT and all your applications are installed on the target system.

    Streamlining the SYSDIFF Process
    The SYSDIFF.INF file, which comes with SYSDIFF.EXE on the NT Server 4.0 CD-ROM, controls the SYSDIFF process. By editing the SYSDIFF.INF file, you can make the cloning process smoother, faster, and more space-efficient. The SYSDIFF.INF file is an inclusion/exclusion file that determines what SYSDIFF.EXE will or won't review when it creates the snapshot and difference files. The SYSDIFF.INF file on the CD-ROM has nine sections:

    • \[Version\]
    • \[ExcludeDrives\]
    • \[ExcludeDirectoryTrees\]
    • \[ExcludeSingleDirectories\]
    • \[ExcludeFiles\]
    • \[IncludeFilesInDir\]
    • \[ExcludeRegistryKeys\]
    • \[ExcludeRegistryTrees\]
    • \[ExcludeRegistryValues\]

    Entries in the SYSDIFF.INF file (as long as the file is in the same directory as SYSDIFF.EXE) direct the cloning process. For example, suppose you add drive E to the \[ExcludeDrives\] section. Then SYSDIFF.EXE will not look at that drive during the creation of the snapshot or difference file. Excluding a drive that contains no useful information can save a great deal of time in the cloning process. However, you need to be very careful about removing default entries in the SYSDIFF.INF file. By doing so, you can make the cloning process unsuccessful.

    Overcoming Side Effects
    Using SYSDIFF.EXE and the difference file to install applications has one side-effect: Files transferred to the target system inherit the date of the installation instead of retaining their original date when they are written to the hard drive, as Screen 6 shows. Thus, the contents of the difference file (Registry changes, .INI file changes, and program and data files new since the first snapshot) are all re-dated when they're copied to the target system.

    If you want to retain the files' original dates, you can split the Registry and .INI changes from the files, apply the Registry and .INI changes, and then copy the files separately instead of using the difference file to install the software. Create the AFTER.INF file as explained in the previous section. Then you can change Registry and .INI files on the target system by adding the .INF file to the list of files to use at installation. You do this task through SETUPMGR.EXE. Start SETUPMGR.EXE, and choose Advanced Options. Then select the Boot Files tab. Add the file path and name, as in Screen 7. When you use the answer file to install NT, the Registry and .INI file changes occur automatically.

    After you make the Registry and .INI changes, your final step is to copy the directories and files to complete the installation. The .INF file-creation procedure conveniently copies all files in the difference file to subdirectories under the $OEM$ subdirectory (which you see in Screen 8). When you copy the files to this subdirectory, their dates change to the current date. Using files in the $OEM$ subdirectory can compromise your security if you date-stamp your files.

    Although you have copied the files to the $OEM$ subdirectory, you don't need to include them in the installation process if you want to preserve the files' original dates and times. Instead of copying and using the files under $OEM$, install NT with an answer file and then copy the originals with XCOPY.EXE to retain file dates and times.

    Repair the Registry
    In addition to cloning, you can use the .INF file to correct a Registry problem with an application (e.g., corrupted files). Ordinarily, you need to reinstall the application and then make the necessary changes to menus, toolbars, and preferences. However, having a list of every change the application installation and modification processes made to the Registry and .INI files would save you a tremendous amount of time in restoring your application.

    If you create a difference file after you install an application, you have this list of changes. To repair the Registry, simply create a loadable .INF file from the difference file as explained earlier. You can then load the .INF file back into the system through SETUPMGR.EXE. But instead of doing another installation over the current NT installation, choose to do an update. Include the .INF file by selecting the Advanced Options and Boot Files options in SETUPMGR.EXE. The Registry will then be updated with the .INF file information.

    Clone Away!
    SYSDIFF.EXE is a versatile tool. You can use it to install NT and all the software you need on multiple systems with the difference file or .INF file method. And, the .INF file created with SYSDIFF.EXE lets you repair Registry files. Let me know how SYSDIFF.EXE's cloning power works for you

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.